CVE-2026-74369: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()

In luo_file_unpreserve_files() and luo_file_finish(), reorder
module_put() and xa_erase() to ensure the file handler module remains
pinned while its operations are being accessed.

Specifically, luo_get_id() dereferences fh->ops->get_id, so the module
reference must be held until after xa_erase() (which calls luo_get_id)
completes.

For luo_file_finish(), this requires moving the module_put() call out of
the luo_file_finish_one() helper and into the main loop of
luo_file_finish() itself.

The Linux kernel CVE team has assigned CVE-2026-74369 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.1 with commit 00d0b372374f2528394aabf7b1f53f8dafe294de and fixed in 7.1.5 with commit f7fca3db635022429382cf26e5b08b33558e375d
	Issue introduced in 7.1 with commit 00d0b372374f2528394aabf7b1f53f8dafe294de and fixed in 7.2-rc1 with commit 291dcd37c8c8f8f8e1bccc92228f44bf371762a8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74369
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/liveupdate/luo_file.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f7fca3db635022429382cf26e5b08b33558e375d
	https://git.kernel.org/stable/c/291dcd37c8c8f8f8e1bccc92228f44bf371762a8